CVE-2026-123664 Details
Description
A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affects some unknown processing of the file /user/email of the component Email Notification Handler. Performing a manipulation of the argument Recipient results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance.
A vulnerability allowing improper authorization has been identified in the NASA General Coordinates Network (GCN) website, specifically in versions prior to b299b562af665878964b981a459f0a9c04b11adf. The issue arises in the Email Notification Handler component, where the Recipient argument can be manipulated, leading to unauthorized actions. This vulnerability can be exploited remotely, allowing authenticated users to subscribe arbitrary third-party email addresses to GCN Notice emails without consent. The recipient is unaware of the subscription, creating potential reputational risks for the GCN.
A pull request to address this vulnerability is currently pending acceptance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nasa-gcn/gcn.nasa.gov/ | [email protected] | Source CodeVendor |
| https://github.com/nasa-gcn/gcn.nasa.gov/issues/3805 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://https:/github.com/nasa-gcn/gcn.nasa.gov/pull/3863 | [email protected] | Broken LinkIssue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-123664 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1033135 | [email protected] | Permission Required |
| https://vuldb.com/vuln/431788 | [email protected] | Content Wall |
| https://vuldb.com/vuln/431788/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nasa-gcn | <= b299b562af665878964b981a459f0a9c04b11adf |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |